3 ms·
> ah yes, the famous XSS coming from your own backend API calls… Author does not seem to understand the concept of XSS. Of course your own API could return use
by snowstormsun 3y ago
> ah yes, the famous XSS coming from your own backend API calls…
Author does not seem to understand the concept of XSS. Of course your own API could return user-provided data to trigger XSS attacks. Entering <script>alert(1);</script> in a messenger to see whether its rendered value is escaped correctly is a famous example.
- andrewflnr 3y agoHence the mentioned hx-disable. Presumably you wrap any user content with that, right?
- snowstormsun 3y agoMaybe I missed that
- freen 3y agoIf that’s the case, and your backend doesn’t sanitize inputs, you’ve already been owned, regardless of your front end framework.
- kitd 3y agoYou missed the response though, that the same user input would also cause problems if it was supplied unsanitized via JSON.